Networking

Overview
Centerpoint is reachable via four distinct paths depending on the use case.
Path
Address / Domain
Use Case
LAN (physical)
192.168.1.85
Direct IP access, management
Tailscale VPN
100.117.158.101
Secure remote access
Traefik (internal)
*.home.local
Named HTTPS on LAN
Traefik (external)
*.jeeves5454.ddns.net / 
*.jeevesconsults.ca
Internet-facing HTTPS
Physical Network
Property
Value
Interface
enp47s0
IP Address
192.168.1.85/24
Default Gateway
192.168.1.1 (Unifi router)
Subnet
192.168.1.0/24
The IP is assigned via DHCP with a static lease on the Unifi gateway, making it
functionally static.
Tailscale Mesh VPN
Centerpoint runs as a Tailscale node and exit node, allowing remote devices to
route all traffic through the home network.
Peer
Tailscale IP
Platform
Notes
centerpoint
100.117.158.101
Linux
This host — exit node
corsec
100.101.27.107
Linux
HA OS server — also exit node
halcyon
100.81.166.2
Windows
Active peer (direct connection)
Mobile
varies
iOS
Occasional peers
Docker Network Architecture
Docker maintains approximately 25 bridge networks on the host. Each application
stack follows a consistent isolation pattern:
Network
Purpose
traefik-net
Shared bridge — all Traefik-fronted containers attach here
*-internal
Per-stack isolated networks for app-to-database communication
media-network
Shared bridge for media stack containers
bridge
Docker default (not used for production workloads)
Typical stack pattern:
Application container → attached to both 
traefik-net and 
<stack>-internal
Database / cache sidecar → attached to 
<stack>-internal only (never on Traefik)
DNS
Internal (
*.home.local): Resolved by AdGuard Home on the LAN. A wildcard DNS
record points 
*.home.local → 
192.168.1.85 so Traefik receives all requests and
routes by hostname.
External (
*.jeeves5454.ddns.net): DDNS via No-IP, keeps the external hostname
updated with the home WAN IP.
External (
*.jeevesconsults.ca): Managed via DNS provider with appropriate
A / CNAME records pointing to the home WAN.
Notes / Gotchas
If AdGuard Home is down, all 
*.home.local DNS resolution fails. Services remain
accessible via direct IP but HTTPS by hostname will not work.
Tailscale must be running (
tailscaled) for the 
100.x address to be reachable.
The large number of 
br-* interfaces visible on 
ip addr is normal — Docker
creates one per network.
Traefik handles all TLS termination; individual containers do not need to manage
certificates.
Last Updated: 2026-06-16